Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add codecast-sh/codecast --skill cast-reviewgit clone --depth 1 https://github.com/codecast-sh/codecastWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/codecast-sh/codecast/cast-review)<a href="https://agentmods.dev/skills/codecast-sh/codecast/cast-review"><img src="https://agentmods.dev/badge/skills/codecast-sh/codecast/cast-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/codecast-sh/codecast/cast-review"><img src="https://agentmods.dev/badge/skills/codecast-sh/codecast/cast-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.00504 |
| Opus 5.5 | $0.00031 | $0.00202 |
| Sonnet 5.5 | $0.00016 | $0.00101 |
| Haiku 4.5 | $0.00008 | $0.00050 |
Grade A, and why
cast-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
A pull request shows the diff. A session also shows the ask, the reasoning, the dead ends and the verification, and those are where most review findings hide.
Read the session
cast summary <id> # goal, approach, outcome
cast diff <id> # files, commits, tools; --patch for the hunks
cast read <id> :10 # the ask and the first plan
cast read <id> --full # the rest; --full to see tool payloads and test output
cast task context <task> # when the session is bound: the acceptance criteria
Match the diff against the ask and the acceptance criteria before reading for quality. The most expensive finding is work that is correct and not what was asked.
Look for
- Requirements in the ask or the task that the diff does not meet.
- Claims in the transcript that the evidence does not support: tests that were not run, a screenshot that shows a different state, a "works" with no output behind it.
- Correctness in the hunks: edge cases, error paths, concurrency, data the change assumes.
- Code that duplicates something the repository already has.
- Changes to files outside the task's scope, and their effect on other
sessions (
/cast-conflictswhen in doubt).
Report
Findings ranked by severity, each with file and line and the reason, then what is done well in one line, then a verdict: pass, needs changes, or reject with the reason. Concrete, no praise padding.
Deliver it where it acts: cast send <id> when the session is live and
should fix it; cast task comment <task> -t review when it is bound to a
task; both when a human owns the session and the agent will do the fixes.
For a worker you spawned, the findings go back as its next instruction.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 47 lines · 78 tokens per session scan A cd57a6e1b6cc
cast-review is a skill published in the GitHub repository codecast-sh/codecast (40 stars, last pushed today), licensed MIT. It adds 78 tokens to every session and 504 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
Other skills, from other repositories
adk-go-self-review
Review an ADK Go change the way a maintainer will — a fresh-context pass over the whole diff, five lenses (correctness and tests, scope, simplicity, style, adk-python parity), and the mutation check that proves your tests pin the change. Use before opening a PR, before any later push that changes code, and when asked…
honey-debt
Harvest honey shortcut markers into a debt ledger.
honey-review
Review a diff for over-engineering; terse delete-list.
review-full
Run a comprehensive multi-perspective code review on recent changes. Also triggers on 'is this secure?', 'security review', 'check for vulnerabilities', 'could this be exploited?' for security-focused review. Produces: GO/NO-GO verdict + findings table (Severity | Category | File:Line | Issue | Recommendation)…
review-diff
Scan git diffs for project-specific anti-patterns. Triggers on: 'scan diff', 'check diff', 'anti-pattern check', 'pattern scan', 'review changes'.
review
Fan out parallel read-only reviewers over a diff and consolidate one severity-ranked verdict.